Exam CS0-002 topic 1 question 276 discussion

Alternate data streams (ADS) is a Windows attribute that allows multiple data streams to be associated with a single file on the NTFS file system. This feature can be used to store additional information or metadata associated with a file. While it can be used for benign purposes, it can also be abused by attackers to hide malicious files within the file records of a benign file. By doing this, the malicious files can evade detection from traditional security tools that only examine the file's main data stream. In the scenario described, the intelligence reports suggest that the threat actor is known for using ADS to hide malicious artifacts, so it is likely that the Windows machine compromised by this threat actor may have evidence of the attack hidden in the ADS. The analyst needs to be aware of the possibility of ADS when examining the machine and must use specialized tools or techniques to find and extract evidence from the ADS.

I know it's C, however, "Based on this intelligence"? ...I dont think the question really helps clarify what the answer is.